https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:06:11.134972+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09397 bdu:2026-09397 2026-10-03T03:06:11.140054+00:00 bdu:2026-09397 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T03:06:11.140086+00:00 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/euvd-2026-276996 EUVD-2026-276996 2026-10-03T03:06:11.140104+00:00 EUVD-2026-276996 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33151 fkie_cve-2026-33151 2026-10-03T03:06:11.140117+00:00

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

 https://cve.radiocsirt.org/vuln/ghsa-677m-j7p3-52f9 GHSA-677m-j7p3-52f9 — socket.io allows an unbounded number of binary attachments 2026-10-03T03:06:11.140144+00:00

Affected: npm: socket.io-parser

### Impact

A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory.

### Patches

| Version range | Used by | Fixed version | |------------------|--------------------------------------------|---------------| | `>=4.0.0 <4.2.6` | `socket.io@4.x` and `socket.io-client@4.x` | `4.2.6` | | `>=3.4.0 <3.4.4` | `socket.io@2.x` | `3.4.4` | | `<3.3.5` | `socket.io-client@2.x` | `3.3.5` |

### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

- Open a discussion [here](https://github.com/socketio/socket.io/discussions)

 https://cve.radiocsirt.org/vuln/sca-2026-0008 SCA-2026-0008 — Vulnerability Affecting SICK Sentio Creator Extension “Software Deployment Manager” 2026-10-03T03:06:11.140180+00:00

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33151 UBUNTU-CVE-2026-33151 2026-10-03T03:06:11.140200+00:00

Affected: Ubuntu:18.04:LTS: node-socket.io-parser, Ubuntu:20.04:LTS: node-socket.io-parser, Ubuntu:22.04:LTS: node-socket.io-parser, Ubuntu:24.04:LTS: node-socket.io-parser, Ubuntu:25.10: node-socket.io-parser, Ubuntu:26.04:LTS: node-socket.io-parser

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1407 WID-SEC-W-2026-1407 — IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen 2026-10-03T03:06:11.140225+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.